PDA

View Full Version : Reminder: Check your Code-Signing Certificate Expiry Date! (August 23, 2013)



NewsArchive
08-23-2013, 03:07 AM
All,

Time flies, whether you're having fun or not. Is your code-signing
certificate due to expire? I would strongly suggest to check this NOW!

"Yes, but how would I do that?" you might ask. It's simple. Just code-sign
a project and the SetupBuilder 8 compiler will tell you (see attached
screenshots). If the validity is <45 days then you'll receive a "GEN113"
compiler warning.

Without a code-signing certificate, you can't do any serious software
development today! No way. It is important that you buy your new
certificate before the expiry date. The identity validation process takes
time. Sometimes it takes a day, sometimes it takes a week or more. Once
the certificate expired, you are unable to code-sign your applications
and/or installations! Setting back your PC clock does not help!

Please note that Comodo does NOT send renewal reminders!

There is no "renewal" process for code-signing certificates if you have
purchased a certificate in the past. You always have to request a new one
and go thru the entire process again. Place a new order using the same
company information and Comodo should speed up the validation process.
Always quote your previous Comodo order number in any correspondence with
them.

To avoid having to resign software every time your certificate expires, use
the timestamping service. When you sign code, a hash of your code will be
sent to Certification authority to be timestamped. This means that you will
not need to worry about re-signing code when your Digital ID expires.
Microsoft Authenticode allows you to timestamp your signed code so that
signatures will not expire when your certificate does.

As a service to our customers, we have partnered with Comodo, Inc., a
leading WebTrust Compliant Certification Authority, to offer Comodo's range
of Code Signing Certificates and Public Key Infrastructure (PKI) based
Secure Sockets Layer (SSL) certificates to qualified Lindersoft customers.
If your Verisign or Thawte certificate is due to expire soon, Lindersoft
customers can switch to a 3-Year Comodo certificate for just $200 instead of
$500.

Do the math: a Verisign Code Signing Digital ID costs $499 for 1 year, $895
for 2 years and $1,295 for 3 years. A Thawte Code Signing Digital ID costs
$299 for 1 year and $549 for 2 years. A GoDaddy Code Signing Certificate
costs $199.99 for 1 year, $359.98 for 2 years and $509.97 for 3 years.

An original Comodo Code Signing Certificate via Lindersoft costs $79 for 1
year, $143 for 2 years and $200 for 3 years!

http://www.lindersoft.com/products_security_services.htm

Friedrich

--
Friedrich Linder
Lindersoft
www.lindersoft.com
+1.954.252.3910

--Helping You Build Better Installations
--SetupBuilder "point. click. ship"
--Create Windows 8 ready installations in minutes
--Official Comodo Code Signing and SSL Certificate Partner

NewsArchive
08-23-2013, 11:46 AM
> To avoid having to resign software every time your certificate expires,
> use the timestamping service. When you sign code, a hash of your code
> will be sent to Certification authority to be timestamped. This means
> that you will not need to worry about re-signing code when your Digital
> ID expires. Microsoft Authenticode allows you to timestamp your signed
> code so that signatures will not expire when your certificate does.

I would like to add some additional information to the above statement.

Not all publisher certificates are enabled to permit timestamping to provide
indefinite lifetime. If the publisher's signing certificate contains the
lifetime signer OID (szOID_KP_LIFETIME_SIGNING 1.3.6.1.4.1.311.10.3.13) in
addition to the PKIX code signing OID, the signature becomes invalid
("Unknown Publisher") when the publisher's signing certificate expires, even
if the signature is timestamped. This is to free a Certificate Authority
(CA) from the burden of maintaining Revocation lists (CRL, OCSP) in
perpetuity.

In other words, the program signature becomes invalid after the certificate
expires, even though the program hasn't changed, and the certificate was
valid when it was signed! As a result, Internet Explorer may report your
signed installer as harmful and UAC may block program execution. You must
re-sign (with a new certificate) your code and re-send it out to your
customers.

But this is only a problem with some "cheap" certificates. Timestamping
ensures that code will *not* expire when your COMODO (or VeriSign, Thawte)
certificate expires.

Friedrich

--
Friedrich Linder
Lindersoft
www.lindersoft.com
+1.954.252.3910

--Helping You Build Better Installations
--SetupBuilder "point. click. ship"
--Create Windows 8 ready installations in minutes
--Official COMODO Code Signing and SSL Certificate Partner

NewsArchive
08-23-2013, 11:47 AM
I have a google calendar reminder, as well. :)

Jeff Slarve
www.jssoftware.com
www.twitter.com/jslarve
I'll search help files & Google for you.

NewsArchive
08-23-2013, 11:47 AM
>
>I have a google calendar reminder, as well. :)
>

Cool :-)

Friedrich

NewsArchive
08-24-2013, 06:55 AM
Who needs Google? I've got the SetupBuilder compiler! :-P

--

Russ Eggen
RADFusion International, LLC